The Vault Was Never Opened: How One Laptop Emptied the World's Biggest Crypto Exchange

Nobody Broke the Vault. They Forged the Withdrawal Slip. Here is

what actually happened. A crypto exchange keeps customer funds in digital wallets controlled by private keys - the secret codes that authorise moving money. Most security effort goes into protecting those keys. In the Binance attack, according to an industry executive quoted by The Indian Express, the wallet itself was not compromised.

The attackers instead seized the pathway through which transaction instructions flow. Binance's initial investigation pointed to a compromised engineer's laptop. That laptop gave the attacker access to a service container - a piece of Binance's internal software - from which it could submit withdrawal instructions the system treated as genuine.

Think of a bank. The thief never cracked the vault. They got hold of a trusted clerk's desk and filled in withdrawal slips the bank processed as routine.

Why it happened so fast TRM Labs estimates that about $6.36 billion moved out of Binance wallets across 10 blockchains, most of it within about 20 minutes.

TRM said transaction signatures had been obtained in advance and the attack was staged well before the theft. Once the instructions were inside the system, the money moved at machine speed. The bank analogy has a limit and it matters.

A bank can reverse a fraudulent transfer. A blockchain transaction cannot be reversed. The roughly $3 billion that was frozen sat mostly in stablecoins - tokens issued by companies such as Tether and Circle, which can lock them.

Much of the rest moved into assets that no issuer controls.

Why one laptop could do this This is what makes centralised exchanges a single point of failure.

A huge pool of customer money depends on a small number of internal systems and the people who run them. Compromise the right engineer and the safeguards built around the keys are simply bypassed. Binance has pledged to cover all losses from its own funds, but a smaller exchange could not.

Where

India stands India's exposure is large and indirect. An industry executive told The Indian Express that India has around 100 million crypto users and that 80% to 90% have direct or indirect exposure to Binance, which supplies most liquidity in the Indian market. India's rules cover this platform only partly:

• Crypto income is taxed at 30% (Section 115BBH), with 1% TDS on transfers (Section 194S).
• Exchanges must register with FIU-IND under the anti-money-laundering law; Binance did so in 2024, after paying an ₹18.82 crore penalty.
• CERT-In requires severe cyber incidents to be reported within 6 hours. None of these sets cybersecurity standards for how an offshore exchange guards customer funds. India supervises the money trail, not the vault.

The state behind the theft TRM Labs and Chainalysis attribute the attack to North Korea.

A UN expert panel previously estimated that North Korean hackers stole about $3 billion in crypto between 2017 and 2023 and that such theft generated about half the foreign currency funding its weapons programmes.

• and India's crypto rules were built to track money, not to secure it.